From c3224411c0c04f8d6965aa33b63dc3ff4b548c25 Mon Sep 17 00:00:00 2001 From: Erik Sundell Date: Fri, 12 Dec 2025 07:45:04 +0100 Subject: [PATCH] NPM: Use env var for OIDC token auth instead of direct npmrc (#115153) * use env var * ignore spellcheck --- scripts/publish-npm-packages.sh | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/scripts/publish-npm-packages.sh b/scripts/publish-npm-packages.sh index 6ee770ee840..3131c791d36 100755 --- a/scripts/publish-npm-packages.sh +++ b/scripts/publish-npm-packages.sh @@ -100,8 +100,11 @@ if (( CHANGES_COUNT > 0 )); then if [ -n "$NPM_AUTH_TOKEN" ]; then # Mask the token so it won't appear in logs echo "::add-mask::$NPM_AUTH_TOKEN" - echo "Configuring npm auth token in ~/.npmrc" - echo "//registry.npmjs.org/:_authToken=${NPM_AUTH_TOKEN}" >> ~/.npmrc + echo "Configuring npm auth via NPM_TOKEN env var" + export NPM_TOKEN="$NPM_AUTH_TOKEN" + # Reference the env var in npmrc (single quotes intentional - npm expands it at runtime) + # shellcheck disable=SC2016 + echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' >> ~/.npmrc else echo "Warning: No token in response, dist-tag operation may fail" fi